Mystery31 Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains how Mystery31 Ltd, trading as Mystery31, handles personal information when you use mystery31.com, buy collectables, create an account, participate in M31 VIP, upload an optional profile image or use customer support. Our online store is powered by Shopify. We also use service providers, described below, to help operate the store. This notice should be read alongside any separate privacy information displayed by Shopify, payment providers or, for eligible international orders, Global-e.

Who controls your information?

For Mystery31's own store operations, Mystery31 Ltd is the data controller under applicable UK data protection law. Company number: 17378819. Registered office: 5 Brayford Square, London E1 0SG, United Kingdom. Correspondence address: 95 Markham Avenue, Leeds LS8 4JD, United Kingdom. Privacy enquiries: gtokyo539@gmail.com (subject: Privacy request).

Shopify, payment providers, Global-e and other third parties may also act as independent controllers for some processing under their own notices and agreements.

Information we collect

Depending on the services you use, we may process:

• Identity and contact information: name, email, delivery and billing address, phone number where provided, and Shopify customer identifiers.
• Orders and payments: products, quantities, order values, order history, refunds, deliveries, payment status and payment method identifiers. Full card details are processed by the relevant payment provider rather than intentionally collected through Mystery31 support systems.
• Account and VIP details: your account identifier, lifetime qualifying spend, membership segment, tier and automatic discount entitlement, plus account preferences.
• Optional avatar image: the image you choose to upload, associated customer account identifier and technical information needed to validate and store the file.
• Customer-support information: ticket reference, department, subject, message text, replies, status, relevant order details and correspondence with authorised staff.
• Website and device information: IP address, browser and device information, access logs, approximate location derived from IP, cookies, analytics and browsing or shopping interactions as applicable.
• Marketing preferences: subscriptions, consent choices and communication preferences.

We generally receive information from you, your interactions with our website, Shopify, fulfilment providers, payment services and any other partner involved in supplying your order. We do not ask you to upload sensitive data or full payment-card details in support tickets or avatars.

Why we process information and the lawful bases

Our processing purposes and likely lawful bases under applicable UK data-protection law include:

• Processing purchases, payment and delivery: performance of a contract or steps requested before entering into one.
• Keeping tax, accounting and legally required records: compliance with legal obligations.
• Preventing fraud, protecting accounts, maintaining security and responding to ordinary enquiries: legitimate interests in operating a reliable, secure retail business, subject to balancing against individuals' rights; legal obligation where relevant.
• Operating your requested M31 VIP account and showing your verified membership level: performance of our account arrangement where necessary, or legitimate interests in providing and improving account features where appropriate.
• Displaying an optional customer-selected avatar: your consent, expressed by choosing to upload a picture for this purpose. Avatar use is optional and can be withdrawn by removing the image or contacting us.
• Direct electronic marketing: consent or another basis permitted by applicable marketing rules; you can opt out or withdraw consent at any time using the unsubscribe link or by contacting us.
• Non-essential cookies and similar tools: consent where required by applicable electronic privacy laws. Essential cookies are used to provide security and core shopping functions.

Where we rely on legitimate interests, those interests include maintaining the website, preventing misuse, improving service reliability and answering customer enquiries. We do not treat consent to optional avatar uploads as consent to promotional use of the image.

Private customer profile images

If enabled, an eligible signed-in customer may optionally upload a JPG, PNG or WebP image up to 2 MB. Our Cloudflare Worker validates the file, processes the image into WebP format and stores the resulting image in a private Cloudflare R2 bucket, associated with the customer's Shopify account ID. The private bucket does not have a public website address; images are delivered to the authorised signed-in account through our authenticated account service. We use this image solely to personalise the customer profile and do not sell or use it in advertisements.

The customer may replace the image or select Remove Image, which deletes the currently stored avatar and restores the default M31 artwork. If the account is closed, the customer cannot access the controls or a deletion request is made, contact the privacy email so any remaining image can be addressed. Technical backups or logs, where applicable, may be retained briefly according to provider schedules or legal requirements. Do not upload sensitive documents, intimate images or another person's photograph without permission.

VIP tier and discount information

We use qualifying historic purchase values and Shopify customer segmentation to determine your displayed Member, Silver, Gold, Platinum or Elite rank and the automatic checkout discount when available. This is a rules-based rewards calculation rather than a decision with similarly significant legal effects. Returned or cancelled orders and account corrections may change the spending value or tier. Only verified account users should be able to view their own account information.

Private support tickets

Customer-support tickets include your correspondence, ticket status and customer account identifier. They are intended to be accessible only by the customer linked to the ticket and authorised Mystery31 staff through access-controlled systems. Ticket content is used to provide assistance, keep an appropriate case history, investigate disputes or misuse and satisfy legal obligations where applicable. Do not include passwords, card security codes or more personal information than necessary. During testing, ticket submissions may be limited to authorised accounts.

Shopify, Global-e and other recipients

We may share information needed to provide our services with Shopify and its supported store features, payment processors, fraud-prevention and security services, Cloudflare (including Workers and private R2 storage), shipping carriers such as Royal Mail, logistics and fulfilment providers, communication and email providers, and professional advisers or authorities where legally required. Each receives only information appropriate to its role and lawful processing purposes.

For eligible international checkout, Global-e may act as merchant of record and process personal information for international sales, taxes, duties, payments and delivery under its own privacy notice displayed during checkout. Shopify may use data under its applicable service and privacy arrangements. We do not sell customer-uploaded avatars or support-ticket messages to advertisers.

Cookies, analytics and marketing

The website uses essential technical cookies and may use analytics, advertising or personalisation technologies, subject to applicable consent settings. Where required, you can use Shopify's cookie consent controls or the site's privacy-choice and data-sharing opt-out controls to set your preferences. Blocking some cookies may affect non-essential functionality. We honour available marketing unsubscribe controls and any legally required opt-out choices. Shopify's automated privacy features may show additional region-specific notices.

Retention

We retain order and accounting information as needed to fulfil transactions and meet statutory recordkeeping requirements. Account and VIP data is generally retained while an account is active, subject to applicable law and appropriate deletion or correction requests. The current avatar is stored while the customer chooses to use it and is removed when deleted through the available control or following a valid request. Support messages are retained for as long as reasonably necessary for customer service, disputes, security, recordkeeping and legal obligations, after which they are deleted or anonymised where appropriate.

Retention may vary by the type of record and a service provider's lawful backup cycles. Contact us if you need more detail about a particular record or wish to make a deletion request.

Security and transfers abroad

We apply appropriate access controls and use established service providers, but no online system can be guaranteed completely secure. Data may be accessed or processed outside the United Kingdom by Shopify or other providers. Where a restricted international transfer occurs, we rely on a permitted transfer mechanism such as applicable adequacy regulations or appropriate contractual safeguards, as relevant. For details of a specific transfer or available safeguards, contact us.

Your rights

Depending on the applicable law and circumstances, you may have rights to access, correct, erase, restrict or object to processing, request portability, withdraw consent and challenge relevant automated decisions. You have the right to object to direct marketing at any time. Withdrawing avatar consent does not affect processing lawfully carried out before withdrawal. We may need to verify identity before acting on a request and may lawfully retain certain records despite a deletion request.

To exercise rights, email gtokyo539@gmail.com with the subject Privacy request. You may also contact the UK Information Commissioner's Office at ico.org.uk if you have concerns about how your information is handled.

Children's privacy

Our shopping and collector-account services are not designed to collect personal data from children without appropriate safeguards and permission where required. If you believe a child has provided information inappropriately, please contact us to investigate.

External sites, updates and additional notices

Links to external websites or platforms are governed by their own policies. We may revise this notice when our services, processing activities or legal obligations change and will update the date and give additional notice where required. Shopify, Global-e and payment providers may show their own additional legally required disclosures during their services. Where this notice conflicts with a mandatory legal right, the law prevails.